Windows Server 2022 — Time drift breaks Kerberos authentication for line-of-business apps — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Users encounter authentication failures because server time skew exceeds Kerberos tolerance, disrupting domain-integrated applications.

Environment & Reproduction

Often after VM host clock issues, disabled time sync hierarchy, or incorrect manual NTP settings.

w32tm /query /status
w32tm /query /peers
Get-WinEvent -LogName System -MaxEvents 60 | Where-Object {$_.Message -match 'Kerberos|time-service|clock'}

Root Cause Analysis

Domain time hierarchy is broken or host/guest time sync conflicts cause drift outside Kerberos skew allowance.

Quick Triage

Check current offset and resync source quickly before restarting auth-dependent services.

w32tm /monitor
net time /domain
klist

Step-by-Step Diagnosis

Validate PDC emulator time source, peer flags, and service startup mode consistency.

w32tm /query /configuration
sc.exe qc w32time
Get-ADDomain | Select PDCEmulator

Solution — Primary Fix

Reconfigure valid NTP hierarchy and force immediate resync on affected servers and clients.

w32tm /config /syncfromflags:domhier /update
Restart-Service w32time -Force
w32tm /resync /force
klist purge

Solution — Alternative Approaches

For isolated segments, set explicit reliable NTP peers with secured allowed list.

w32tm /config /manualpeerlist:'0.pool.ntp.org,1.pool.ntp.org' /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /resync /force

Verification & Acceptance Criteria

Time offset returns within acceptable thresholds and Kerberos tickets issue normally for impacted users/apps.

w32tm /query /status
klist get host/
Get-WinEvent -LogName System -MaxEvents 30 | Where-Object {$_.Message -match 'Kerberos'}

Rollback Plan

If resync source is unstable, restore previous trusted time configuration and remove temporary peers.

w32tm /config /syncfromflags:domhier /update
Restart-Service w32time

Prevention & Hardening

Monitor time offset continuously, harden NTP path, and include drift checks in VM/host maintenance plans.

w32tm /stripchart /computer: /samples:5 /dataonly
Register-ScheduledTask -TaskName 'TimeDriftCheck' -Action (New-ScheduledTaskAction -Execute 'w32tm.exe' -Argument '/query /status') -Trigger (New-ScheduledTaskTrigger -Once -At 01:00 -RepetitionInterval (New-TimeSpan -Minutes 30))

Related Errors & Cross-Refs

Related to KRB_AP_ERR_SKEW, logon failures after host migration, and domain trust issues caused by time instability.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Windows Time service and Kerberos troubleshooting documentation for domain-joined Windows Server systems.